GitHub Advisoryadvisory · Go

GHSA-wxjg-p59j-6c92 Command injection in github.com/google/fscrypt

MEDIUM Published 2022-02-26 Modified 2022-03-08 Official page ↗
Aliases
CVE-2022-25328
Ecosystem
Go
Packages
github.com/google/fscrypt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-78
Reviewed
2022-03-01

Affected packages

• Go github.com/google/fscrypt: < 0.3.3 → fixed in 0.3.3

Description

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

Related

Alias · CVE (1)

  • CVE-2022-25328 The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References